H.B. 2341 - Consumer Data Protection Act

• Establishes the Consumer Data Protection Act requiring controllers and processors handling personal data of Hawaii residents to implement transparency measures, security practices, and consumer rights protections.

• Grants consumers the right to access, correct, delete, or port their personal data; opt out of targeted advertising, data sales, and certain profiling; and appeal controller decisions within 60 days.

• Requires controllers to conduct data protection assessments for targeted advertising, data sales, profiling with foreseeable risks, sensitive data processing, and other high-risk activities created after January 1, 2024.

• Exempts government entities, financial institutions, healthcare entities under HIPAA, nonprofit organizations, and institutions of higher education from the chapter's requirements.

• Authorizes the Attorney General to investigate violations, issue civil investigative demands, seek injunctions, and impose civil penalties up to $7,500 per violation; establishes a consumer privacy special fund for collected penalties and administrative costs.